Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    02-01-2025 22:01

General

  • Target

    58a741bad1791584b188d8fab8e83e6c3b4caa7f680591ed8108746f64ea2742.apk

  • Size

    277KB

  • MD5

    386217b8f75935cda730a03d6ba89006

  • SHA1

    8964110e2f726c46afe7595b56af0a78ccbd84bf

  • SHA256

    58a741bad1791584b188d8fab8e83e6c3b4caa7f680591ed8108746f64ea2742

  • SHA512

    b5079248c56f2c46028e35be87b57a1f1112357055be621e58422bba09235ab4ddcd4e82a5015372767a44910ab7134ceb0c630314bf6adae94583e8b932ff59

  • SSDEEP

    6144:tSb6Rg0kaYNU7rsZ7QbBKrTyU+kiyXZrm7Y4cd5nlSfkwo/EuGh9c:fg0VYNosZMVKvybermcdfno+nES

Malware Config

Extracted

Family

octo

C2

https://skylinejr.top/YTZhZjliODdlYTI4/

https://forestnx.top/YTZhZjliODdlYTI4/

https://moonlightvg.top/YTZhZjliODdlYTI4/

https://seabreezehf.top/YTZhZjliODdlYTI4/

https://riverflowbd.top/YTZhZjliODdlYTI4/

https://starbursttc.top/YTZhZjliODdlYTI4/

https://wildspiritzm.top/YTZhZjliODdlYTI4/

https://dreamcatcherly.top/YTZhZjliODdlYTI4/

https://goldenpathrw.top/YTZhZjliODdlYTI4/

https://sunbeamfc.top/YTZhZjliODdlYTI4/

https://stormchaserqt.top/YTZhZjliODdlYTI4/

https://cloudburstkp.top/YTZhZjliODdlYTI4/

https://nightshadewm.top/YTZhZjliODdlYTI4/

https://earthboundxl.top/YTZhZjliODdlYTI4/

https://fireblazeqh.top/YTZhZjliODdlYTI4/

https://oceanviewjk.top/YTZhZjliODdlYTI4/

https://silverstreamph.top/YTZhZjliODdlYTI4/

https://mountainpeakyd.top/YTZhZjliODdlYTI4/

https://blueskytm.top/YTZhZjliODdlYTI4/

https://greenfieldzc.top/YTZhZjliODdlYTI4/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.sgakagak.agakagabs
    1⤵
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5061

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.sgakagak.agakagabs/.qcom.sgakagak.agakagabs

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    230B

    MD5

    cf5d2ebcea3ca92493a66b4c0e03d465

    SHA1

    fd59ff564406d1f716d1e420f23e5c8d06b8eeba

    SHA256

    a1786fb56401e61102fe353d03a5466532ffdb99dd511e59ed110d77d71eec15

    SHA512

    7f5be62065f1739eb448237d7232b0e3ac0cfbdcef2c2101c27447ac476f30328a1b35f7060eec4027f38fbe3af891fc1b009f931f97ac50112759ddb011aef7

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    54B

    MD5

    ecda5ec22eaf1b279b841754ba6b5b65

    SHA1

    73c6052b04f11228c6c0debb9eed8616fd28fb22

    SHA256

    385a113d6a9317e1af0fb07e92d007737da0ac2ab744b935f3db3db6160f31e4

    SHA512

    8b6905e2b6980a5e34f2a0acd02138211c1cb88a3c64f2ab0e4447dcb28195276d3689c06e2bf9d897ad8b2a04adc9ecc7ff03015e3d108277c2504684d929dd

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    68B

    MD5

    77772ff603f2df6a572484be48bf2be3

    SHA1

    c87084893d8296ea0fd1bba752e77722511b6089

    SHA256

    f8355a21754ddd7179904ff127451e3525a6a3ad9dffeb717d1b01575e9d4cbe

    SHA512

    3c7c56e24bc0a99019fdee93c20007e4b4380217af142816ae90e9011c0ea54b5de993a041628dc6bdc9fc3721d416c00314831467346b22818df6b302ba03b9

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    63B

    MD5

    ea4e708757f6e48fc0b9ca2a0ff395b6

    SHA1

    e58afb4eb55c5483836592c609b8bb413a116907

    SHA256

    e5aaa184d4544f7c88d7a2fd46b1a5187d2303cd835559390a83f38b664f554c

    SHA512

    88b7f9d047c67e749852507467ee57d475f1ae7d6b7c168e2256ebb16a7b72a4bd07d26a6141ca6612678b62db43c22b8d8d9e274636c89be77bef8bc0c44e2a

  • /data/data/com.sgakagak.agakagabs/kl.txt

    Filesize

    423B

    MD5

    3112eea204c0cb33e34e96ffffd41651

    SHA1

    978d81c3912b43bb6dacf7921bf726b8a8503238

    SHA256

    dcbf09860487402772e0e3ad2c287387406fca32298b6213a8074b3f2292af2b

    SHA512

    5972e8c343eb7ffea2076e4d7eea48c87a1a0dea89235556a2e6d75aee77594c9847d69f95225b55592f3d08affca53ec5e1aace9381a3c683ead1faf668aa0e